Xcs cross channel scripting and its impact on web applicationsXcs cross channel scripting and its impact on web applications
  1. publications
  2. web security

Xcs cross channel scripting and its impact on web applications

Available Media

Publication (Pdf)

Slides (pdf)

ConferenceComputer and Communications Security
AuthorsHristo Bojinov , Elie Bursztein , Dan Boneh
Citation

Bibtex Citation

@inproceedings{ BOJINOV2009XCS,title = {Xcs cross channel scripting and its impact on web applications},author = {"Hristo, Bojinov" and "Elie, Bursztein" and "Dan, Boneh"},booktitle = {Computer and Communications Security},year = {2009},organization = {ACM}}

We study the security of embedded web servers used in consumer electronic devices, such as security cameras and photo frames, and for IT infrastructure, such as wireless access points and lights-out management systems. All the devices we examine turn out to be vulnerable to a variety of web attacks, including cross site scripting (XSS) and cross site request forgery (CSRF). In addition, we show that consumer electronics are particularly vulnerable to a nasty form of persistent XSS where a non-web channel such as NFS or SNMP is used to inject a malicious script. This script is later used to attack an unsuspecting user who connects to the device web server. We refer to web attacks which are mounted through a non-web channel as cross channel scripting (XCS). We propose a client-side defense against certain XCS which we implement as a browser extension.

Recent

newsletter signup slide

Get cutting edge research directly in your inbox.

newsletter signup slide

Get cutting edge research directly in your inbox.